[Bug] [LDAP] DS LDAP authenticator needs improvements

[EricGao888]

Search before asking

• [X] I had searched in the issues and found no similar issues.

What happened

• Currently, DS LDAP authenticator is not very easy to use. In some situations, it may not work.

What you expected to happen

• First, current DS LDAP authenticator needs LDAP administrator credentials, and then searches the accurate DN of the login user. This is unnecessary and inconvenient for DS users, sometimes making users confused. Users should provide accurate DN and DS LDAP authenticator will verify the LDAP user directly. https://github.com/apache/dolphinscheduler/blob/62b85b9cb3110290519966743c40d0f40ce6af3b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/ldap/LdapService.java#L45-L64
• DS LDAP authenticator relies on LDAP email attribute to verify LDAP user. But sometimes there is no such attribute on LDAP side. https://github.com/apache/dolphinscheduler/blob/62b85b9cb3110290519966743c40d0f40ce6af3b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/ldap/LdapService.java#L92-L112
• InitialLDAPContext is not closed and will take unnecessary resources.

How to reproduce

• Already described above.

Anything else

No response

Version

dev

Are you willing to submit PR?

• [X] Yes I am willing to submit a PR!

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

[github-actions[bot]]

Thank you for your feedback, we have received your issue, Please wait patiently for a reply.

• In order for us to understand your request as soon as possible, please provide detailed information、version or pictures.
• If you haven't received a reply for a long time, you can join our slack and send your question to channel #troubleshooting

[EricGao888]

Here is an example for two kinds of LDAP configurations which Apache Airflow is using: Click here for more information.

[EricGao888]

For the approach which does not need administrator password and username, you could try this command to test the authentication ldapsearch -v -h ip:port -D uid=xxx,ou=xxxx,o=xxx -w login_user_passoword -x -b ou=xxx,o=xxx @liqingwang

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity for 30 days. It will be closed in next 7 days if no further activity occurs.

[EricGao888]

No stale, I'm coming for ya!🤣

[huage1994]

Hi @EricGao888 , I'd like to submit a PR.

[EricGao888]

Hi @EricGao888 , I'd like to submit a PR.

@huage1994 Sure, thx for helping out~

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity for 30 days. It will be closed in next 7 days if no further activity occurs.

[github-actions[bot]]

This issue has been closed because it has not received response for too long time. You could reopen it if you encountered similar problems in the future.